Algorithmic Audit Program

How to use this document

• What it is for. This is a base program to plan, perform, report and follow up internal or external audits of the organization's AI systems: their governance, data, performance, bias, security, the rights of affected people and vendors.
• Who should own it. Usually internal audit or, if there is none, a person independent of the audited systems or an external auditor, with the AI committee (or management, in small organizations) receiving the reports. The designated auditor is not a new governance role: it is whoever meets the independence requirements of Section 3. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Before adopting it, decide who audits and how their independence is protected (Section 3), which audit criteria are used (Section 4), how often each risk level is audited (Section 5) and which remediation deadlines apply to each severity (Section 10).
• Fields to complete. Replace the bracketed fields, such as [ORGANIZATION NAME], [AI COMMITTEE], [REVIEW FREQUENCY] and [COMPLETE], and prepare the annual plan in aid E. Keep [OPTIONAL] clauses only if they apply.
• Country variants. This document has no country variants. Some laws require specific audits, such as independent bias audits, periodic assessments of automated decisions at work or reviews following data protection authority guidance. Identify them in "Related regulatory references" and add them to the annual plan as mandatory audits.
• Review. Ask legal to confirm which audits are mandatory for you and who may perform them, and data science to validate the technical tests in Section 8.
• Approval and publication. Have it approved by [AI COMMITTEE] or the audit committee, record the approval in "Version history" and share the annual plan with the owners of auditable systems.

Algorithmic Audit Program

Field	Value
Organization	[LEGAL ENTITY NAME]
Function owning the program	[RESPONSIBLE FUNCTION]
Program owner	[OWNER]
Report recipient	[AI COMMITTEE]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]

1. Purpose

1.1 This program sets out how [ORGANIZATION NAME] plans, performs, reports and follows up audits of its AI systems, the data they use, the controls around them and the vendors that supply them.

1.2 Its purpose is to provide an independent, evidence-based assessment of whether the designed AI governance works in practice and whether systems behave as expected for the people they affect.

2. Audit universe

2.1 The audit universe comprises:

a) the AI governance system: policies, roles, committee, inventory, risk assessment, training and continual improvement;
b) AI systems in production, with priority for those that decide on or influence people;
c) training, validation and test data sets, and data quality processes;
d) monitoring, incident management and deactivation and rollback mechanisms;
e) transparency, explanation, human review and complaint mechanisms;
f) AI vendors on which High systems depend and their compliance with contractual commitments;
g) systems in "Pilot" state or in development that will go into production at High level.

2.2 The audit function keeps the audit universe reconciled with the AI system inventory.